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Portable Modem Interception Mumnpors 




Applications 

• Field deployment and other temporary 
set-up scenarios 

• Permanent set-up in monitoring centres 
and remote offices 

• Operations where direct access to target 
lines is required 

• Internal Investigations 

• Covert Operations 



Features 

• Easy set-up 

• Easy to operate 

• Automatic Modem Detection 

• Supports V.90 and V.92 

• Web page Decoder and Viewer 

• E-mail Decoder and Viewer 

• Password Acquisition for non-encrypted 
protocols 
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Portable Modem Interception Man, n pots 



The Munin POTS is a true portable modem intercept solution 
to be used in operations, where direct access to the target lines 
is required. 

This unit can be deployed in the field close to the target or 
installed on a permanent basis in a monitoring centre. Due to 
the unique design of the physical line interface, the system is 
completely undetectable by the target and transparent to all 
parties on the line, making it ideal for all covert operations. 

The onboard sets of features enable you to solve your tech- 
nically difficult monitoring tasks in a non-technical way and 
achieve your results with minimum effort. 



System Summary 

The Munin system is delivered 
as a complete turnkey solution 
including all cables and acces- 
sories. It consists of a high qua- 
lity and special designed PSTN 
line interface and a lunchbox 
computer for recording and de- 
coding. It is very easy to ope- 
rate and it only takes a few 
hours of training to use it at 
its fullest potential. 

The system intercepts and re- 
cords all dial-up modem traffic 
on any two-wire analogue PSTN 
line and has no influence on 
normal voice or fax traffic on 
the intercepted target line. 

V.90 and V.92 is supported but 
will be trained down to 33.600 
from the interface box towards 
the target. 



I he target line is connected 
in serial to the line interface 
box that further connects to 
the lunchbox computer - 
power it up and you are ready 
to go. 

System Features 

The direct connection through 
the line interface box during 
non-modem sessions makes 
the intercept undetectable. 

Ringing, On / Off hook voltage, 
call waiting and other services 
operate unaltered even when 
the interface box is powered off. 

The Munin decoding software 
is a layered protocol decoder. 
This means that the decoder is 
organised in the same way as 
the TCP/IP protocol stack itself. 



This gives the benefit of easy 
updating, replacement or ex- 
tension of one decoder proto- 
col layer without affecting 
the others. 

Application Layer 

The received TCP packets are 
being sorted and treated de- 
pendent on the type of com- 
munication taking place: 

• HTTP 

• POP3 

• SMTP 

• IMAP 

• NNTP 

• IRC 

• TELNET 

• FTP 

• VoIP, H.323, SIP 

• ICQ 

• AOL IM 

• Yahoo IM 

• MSN Messenger 

• AOL 6, 7 and 8 

• Kazaa 

and many other internet pro- 
tocols and services. 

HTTP communication through 
a proxy server is not exchanged 
on a well-known port and 
therefore treated as of type 
Unknown, but the HTTP com- 
munication packets are still 
extracted and stored on the 
hard disk. 



SMTP / POP3 


HTTP 


Application layer 


TCP 


UDP 


Transport layer 


IP 


Network layer 


PPP 


Data Link layer 


PSTN line 


Physical layer 



E-Mail, SMTP, POP3 and IMAP 

E-mail fragments in the TCP 
packets data section are ex- 
tracted and collected. When 
an e-mail is finished, it is saved 
to disk and a HTML copy is 
made with a link to all attach- 
ments. 
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All possible attachments spe- 
cified in the MIME standard 
are saved as files on the hard 
disk for later investigation. 

User Identifications and Pass- 
words are collected and shown 
for all non-encrypted protocols. 

HTTP and HTML 

All HTTP communication is 
saved in a log file that can be 
further investigated. 

A directory structure that mir- 
rors that of the visited web 
page is created containing a 
copy of all the received HTML 
pages including pictures, links 
and other page elements. 

Unsupported 

All unsupported protocols are 
detected, listed and stored as 
raw data packets on the hard 
disk for manual investigation. 
The log file containing the low- 
level raw decoded data packets 
is accessible through the end 
user software as clear text. 

The Transport Layer 

Received IP packets are being 
sorted and treated depen- 
dent on the encapsulated 
protocol type: 

TCP - the packets are detect- 
ed and sent to the applicati- 
on layer. 

UDP - the packets are deco- 
ded and saved. 

ICMP - the messages are 
decoded and saved. 
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The Network Layer 
Currently IPv4. 

IP packets are received. 

The packets can be compres- 
sed and / or fragmented. 

IP packets are reconstructed 
and sent to the transport layer. 

Supports Van Jacobson com- 
pression. 

The Data Link Layer 

PPP with sub-protocols - LCP, 
CHAP / PAP, IPCP, CCP, CBCP 
and LQRP. 

All communication is recorded 
in a main log file that can be 
further investigated and ana- 
lysed through our extensive 
toolset in the software package. 

The following Compression 
Protocols are available and 
decoded: 

• Microsoft PPC 

• Stac Electronics LZS 

The Physical Layer 

Modem Protocol: 

Up to V.90 and V.92. 

Other Features 

Collection of all dialled num- 
bers with timestamps. 



You can listen to any Voice over IP traffic. 
The audio player contains an automatic 
gain control filter to enhance the audio. 

With these advanced tools you are able 
to follow whatever the target is doing on the 
internet and you can easily pinpoint 
any illegal activity. 

Information can be copied to the built-in 
CD or DVD writer for presentations in court 
or other purposes. 



«♦ The intercepted traffic is decoded into 
readable information and you have access to 
a broad range of tools for dealing with the 
intercepted data. 

• Web pages 

• E-mails 

• Attachments 

• Chat Sessions 

• Web mail 

• Voice over IP 

• File Transfers 

• Messenger Services 

Please contact us for a complete and updated 
list of supported protocols. 
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System Overview 
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Technical specifications 


Portable Modem Interception - Munin POTS 


System Platform* 


Portable Lunchbox with built-in screen and keyboard 


Internal Modems 

Protocols 


V.21 Bell r V.22 Bell r V.22bis r V.23 r V.32 r V.32bis, V.34 
(33.6/28.8), K56flex (56000), V.90, V.92 (56000) 


Internet protocols 
PSTN Line Interface 


HTTP, POP3, SMTP IMAP NNTP r IRC r TELNET, FTP, VolP r H.323, SIP, ICQ, 
AOL IM, Yahoo IM r MSN Messenger, AOL 6, 7 & 8, Kazaa 


Connector 


Modular plug (RJ11) in parallel with Banana Jack 4 mm with cross hole 


Power Input 
Connector 


IEC Plug, 115 / 230 V Selections 


Power Supply 

AC input 


250 W / 100-120 V / 50-60 Hz 
200-250 V / 50-60 Hz auto select 
EN60950 EMI EN55022 Class B 


Dimensions (HxWxB) 


41x31x25 cm / 16.1x12.2x9.8 inches 


Weight 


9.75 kg/ 21 .5 lbs. 



Environmental specifications 



Temperature 

Operating temperature Range 
Storage temperature Range 


0 C to 50* C/32 F to 122 F 
-40 C to 70* C/ -40 F to 158F 


Humidity 

Range 


Max. 90% 


Options 

Hard Carrying Case 
Dial-in Access 





External Storage 

+ Mur i in POTS is also available with a stationary PC 
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If you would like further Information about ELAMAN, 
or would like to discuss a specific requirement or project, please contact us at: 

Elaman GmbH 
German Security Solutions 
Seitzstr. 23 
80538 Munich 
Germany 

Tel: +49-89-24 20 91 80 
Fax: +49-89-24 20 91 81 
info@elaman.de 
www.elaman.de 






